release

[jajeffries]

Summary

Promote develop to release so the Release workflow can publish a new PyPI build.

What changed

• ENGHLP-1703 — DIODE_SKIP_TLS_VERIFY / skip_tls_verify now matches Go semantics via a local skip-verify tunnel for grpcs:// targets (merged in fix(ENGHLP-1703): keep TLS when DIODE_SKIP_TLS_VERIFY is set #114).
• chore — CODEOWNERS update (chore: remove paulstuart from CODEOWNERS #115).

Made with Cursor

[github-actions]

Coverage Report

File	Stmts	Miss	Cover	Missing
/opt/hostedtoolcache/Python/3.10.21/x64/lib/python3.10/site-packages/netboxlabs/diode/sdk
_skip_verify_tunnel.py	236	12	95%	92, 95, 116–118, 160, 212, 219, 265–267, 326
chunking.py	33	1	97%	112
client.py	597	41	93%	195–196, 215–216, 235–237, 240–243, 333, 573, 641, 646, 650, 738–740, 769–771, 801, 833, 855, 857, 931, 962, 970, 1032–1033, 1042, 1075, 1102, 1107–1108, 1137, 1142–1145
exceptions.py	44	3	93%	69, 82–83
TOTAL	925	57	94%

Tests	Skipped	Failures	Errors	Time
257	0 💤	0 ❌	0 🔥	6.565s ⏱️

[nbl-ai-review]

AI Code Review — risk tier: Full · dimensions run: correctness, security

Advisory only. A human owns the merge decision.

Summary — This is a release-promotion PR (develop → release) carrying the already-reviewed skip-TLS-verify tunnel (#114) and a CODEOWNERS update (#115). Correctness review found no defects. Security review surfaced one real but low-blast-radius issue in the existing tunnel code, already partially documented.

Findings

• netboxlabs/diode/sdk/_skip_verify_tunnel.py:171 — [Medium] security Proxy-Authorization sent in cleartext even for an https:// proxy URL — SkipVerifyTunnel._connect always issues the CONNECT over a bare TCP socket (see _http_connect, lines 77-101), regardless of the proxy URL scheme, so an authenticated proxy (HTTPS_PROXY=https://user:pass@proxy:443) has its Basic-auth credentials sent in the clear. README.md already notes "the CONNECT to the proxy is always plain HTTP whatever the proxy URL scheme says," but an operator choosing https:// specifically to protect those credentials is silently downgraded the moment DIODE_SKIP_TLS_VERIFY is also set — exactly the on-path-attacker scenario (e.g. mitmproxy) the README's own example describes. Suggest either performing a TLS handshake to the proxy before CONNECT when its URL scheme is https://, or failing fast / warning loudly (not just in docs) when an authenticated https:// proxy is combined with DIODE_SKIP_TLS_VERIFY.

Pre-existing / out-of-scope

• None identified beyond the finding above, which is in-scope for the behavior this release promotes.

_{🤖 AI Code Review · run · prompts: code-review/v1 · models: claude-sonnet-5/medium · context: description · 0 comment(s) · 0 prior AI review(s) · usage: $1.53 · 1928k in (91% cached) · 24.2k out}

[github-actions]

🎉 This PR is included in version 1.14.2 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀